Data management methods and systems for container systems

Abstract

A method and system for managing data in a container system is provided. The system includes a memory and a processor, the processor configured to generate a key pair and encrypt a data credential with a public key to create a data credential secret. Operation of the processor stores the data credential secret in a cluster on a host, deploys a workload on the cluster, builds an empty bundle on the host, and creates a pod trusted execution environment.

Description

Technical Field

[0001] This disclosure relates to digital storage management, and more particularly to data management of open source containers.

Background Art

[0002] Cloud computing is increasingly implementing container systems for deployment. The open source container environment proposes adaptive load balancing, service registration, deployment, operation, resource scheduling, and capacity scaling. An open source container cluster utilizes nodes, and the nodes can pull, hold, and use data.

Summary of the Invention

[0003] Embodiments of the present disclosure include a system, a method, and a computer program product for image management in an open source container system.

[0004] A system according to the present disclosure can include a memory and a processor that communicates with the memory. The processor can be configured to perform operations including generating a key pair and encrypting data qualification information with a public key to create a data qualification information secret. The operations can further include storing the data qualification information secret in a cluster on a host and deploying a workload on the cluster. The operations can also include constructing an empty bundle on the host and generating a pod trusted execution environment.

[0005] In some embodiments of this disclosure, the operation may include submitting a data pull request using encrypted data pull credentials and decrypting the data credential secret with a private key in a pod trust execution environment to generate decrypted data. In some embodiments, the operation may further include transferring the data pull request to a pod trust execution environment using a shim. In some embodiments, the operation may further include submitting the decrypted data to a CRI image service in the pod trust execution environment.

[0006] In some embodiments of this disclosure, the operation may include calling a CRI runtime service to generate a real container bundle and invoking the real container bundle. In some embodiments, the operation may include decrypting a data credential secret in the real container bundle.

[0007] In some embodiments of this disclosure, the operation may include receiving a container request and receiving a pull data request using a data credential secret.

[0008] In some embodiments of this disclosure, data credentials may be image credentials.

[0009] The above summary is not intended to describe any of the illustrated embodiments or means of the present disclosure.

[0010] The drawings included in this application are incorporated herein and form part thereof. The drawings illustrate embodiments of the disclosure and, together with this description, are useful in illustrating the principles of the disclosure. The drawings illustrate only certain embodiments and do not limit the disclosure. [Brief explanation of the drawing]

[0011] [Figure 1] This figure illustrates a data management system according to some embodiments of the present disclosure. [Figure 2] This figure shows a data management system according to some embodiments of the present disclosure. [Figure 3] This figure illustrates a data management method according to some embodiments of the present disclosure. [Figure 4] This figure illustrates a data management method according to some embodiments of the present disclosure. [Figure 5] This figure illustrates a cloud computing environment according to an embodiment of the present disclosure. [Figure 6] This figure shows an abstract model layer according to an embodiment of the disclosure. [Figure 7] This is a high-level block diagram of an exemplary computer system used in implementing one or more of the methods, tools, and modules, as well as any related functions, described herein, in accordance with embodiments of the present disclosure. [Modes for carrying out the invention]

[0012] The present invention is open to various modifications and alternative forms, the details of which are shown as examples in the drawings and will be described in detail. However, it should be understood that the intent is not to limit the invention to the specific embodiments described. Rather, the intent is to encompass all modifications, equivalents, and alternative forms that fall within the scope of the invention.

[0013] The aspects of this disclosure relate to digital storage management, and more specifically to image management of open-source containers.

[0014] Open-source container systems may include the use of container runtime interfaces (CRIs) to manage data held by or used within the system. For example, a workload image may be pulled into a worker node for use by a container. Data (such as a workload image) may be directly accessed on the worker host by workloads in other containers without inter-container security checkpoints. Sensitive data (such as information about a user, including information in a user's image) may be exposed to unauthorized entities. Furthermore, when data is stored in etcd in an open-source container cluster, it may only be base64 encoded, resulting in the information being visible to other containers or the administrator of the open-source container cluster. As a result, users may hesitate to store their data on a host.

[0015] This disclosure provides a data management system and method for use in open-source container clusters to protect workload data and maintain data pull privacy. Various types of data, such as documents, spreadsheets, code files, databases, images, and others, can be managed in accordance with this disclosure. In some embodiments of this disclosure, managed data may include one or more managed images.

[0016] Open-source container data management may involve pulling workload data via a CRI (Clustered Repository) so that all data is pulled to worker nodes. For example, if an end user uses containerd as a backend service, images may be stored in the k8s.io namespace, and these images can be directly accessed on the worker host. This mechanism lacks security, and as a result of this lack of security, some users may not want their container image data stored on the worker host. Data pull secrets (image pull secrets in the example above) may be encoded only in base64 and then stored in the cluster's etcd, and as a result, the data can be seen by the cluster administrator or by other containers in the pod.

[0017] In accordance with this disclosure, end users can store data in trusted virtual machines (VMs) to protect data pull secrets, which can be encrypted before use and decrypted only in trusted VMs. End users can run workloads on trusted VMs while protecting and securing their data.

[0018] A system conforming to this disclosure may include memory and a processor that communicates with the memory. The processor may be configured to perform operations that include generating a key pair and encrypting data credentials with a public key in order to create a data credential secret. The operations may further include storing the data credential secret in a cluster on a host and deploying a workload on the cluster. The operations may also include generating an empty bundle on the host and generating a pod trust execution environment.

[0019] In some embodiments of the present disclosure, the operation can include submitting a data pull request using encrypted data pull eligibility information and decrypting a data eligibility information secret with a private key in a pod trusted execution environment to generate decrypted data. In some embodiments, the operation can further include transferring the data pull request to the pod trusted execution environment using a shim. In some embodiments, the operation can further include submitting the decrypted data to a CRI image service within the pod trusted execution environment.

[0020] In some embodiments of the present disclosure, the operation can include invoking a CRI runtime service and starting a real container bundle to generate a real container bundle. In some embodiments, the operation can include decrypting a data eligibility information secret in the real container bundle.

[0021] In some embodiments of the present disclosure, the operation can include receiving a container request and receiving a pull data request using data eligibility information secret.

[0022] In some embodiments of the present disclosure, the data eligibility information may be image eligibility information.

[0023] FIG. 1 illustrates a data management system 100 according to some embodiments of the present disclosure. The data management system 100 includes a host 102, a guest 120, placeholder data 140, and other components that interact with them.

[0024] Host 102 can have a node agent 110 (e.g., kubelet) that communicates with a runtime service 112 and a data service CRI plugin 118. The runtime service 112 can communicate with a CRI service CRI plugin 114, and the CRI service CRI plugin 114 can communicate with the data service CRI plugin 118 and a shim 116.

[0025] The data service CRI plugin 118 can generate, communicate with, or both, placeholder data 140. The placeholder data 140 can be information sufficient to fulfill the cluster's application programming interface (API) requirements. The placeholder data 140 can be stock information or other information related to, or unrelated to, content data 130 that will be stored on the cluster such that host 102 can properly prepare for the content data 130 while protecting the privacy and security of the content data 130. The placeholder data 140 can include metadata 142, content 144, or data components 146, or a combination thereof (e.g., a snapshot of an image, or a page of a document).

[0026] The data component 146 can communicate with an empty bundle 148 on host 102. The empty bundle 148 can exist on the host independently of direct communication with other objects on host 102. For example, while some methods of data management can have a bundle that communicates with the CRI service CRI plugin 114, or a guest 120 or its subcomponents, or a combination thereof, according to the present disclosure, the empty bundle 148 can be independent of both the CRI service CRI plugin 114 and the guest 120 and its subcomponents.

[0027] Shim 116 can communicate with guest 120 via agent 122. Agent 122 can generate container 124 and communicate with content data 130 which will be stored in accordance with this disclosure. Content data 130 may include, for example, data component 132, content 134, and metadata 136. Agent 122 can communicate directly with content 134 within content data 130. Content data 130 can prompt the generation of bundle 126 on guest 120, and bundle 126 can communicate with container 124 which communicates with agent 122.

[0028] In some embodiments, a user can generate a key pair and encrypt a Docker image secret using the public key in the key pair. The user can store the encrypted image pull secret in a cluster and configure the cluster to use a trusted image service. The user can deploy a workload as standard, and the trusted image service can generate fake container image data on the host and cache the associated pull image request in memory. A trusted VM shim plugin can query the new VM image service to obtain the associated pull image request in memory. The trusted VM shim plugin can call the trusted VM service to create a trusted VM, and a private key may be stored in the trusted VM so that no entity can directly access the trusted VM. The trusted VM shim plugin can forward the pull image request to the trusted VM. In the trusted VM, the encrypted image pull secret can be decrypted using the private key from the key pair. Container image data may be pulled to the trusted VM, and the trusted VM shim plugin can create a container using the pulled container image.

[0029] Figure 2 shows a data management system 200 according to some embodiments of the present disclosure. The data management system 200 may include submissions from users 210, a cluster 220, a VM provider 250, and a pod trust execution environment 260.

[0030] A submission from user 210 may include a key pair 212 and encrypted credentials 214. The user can submit the key pair 212 and encrypted credentials 214 to cluster 220. Cluster 220 may be any container cluster, including open-source container clusters such as a Kubernetes(R) cluster (also known as a k8s(R) cluster), an OpenShift cluster, or other container clusters. Cluster 220 can store the encrypted credentials 214 (222) and deploy worker nodes 230 (224).

[0031] A worker node 230 may include a node agent CRI client 232 and a container runtime 240. The node agent CRI client 232 may be, for example, a kubelet CRI agent or a similar server process. The container runtime 240 may include a CRI data service extension 242, a CRI data service 244, a CRI runtime service 246, and a shim plugin extension 248. The node agent CRI client 232 can communicate with the CRI data service extension 242 and the CRI runtime service 246.

[0032] The CRI data service extension 242 can cache encrypted credentials 214 and generate an empty container request to the host. The shim plugin extension 248 can receive the generated empty container request and can also receive any data pull request using the encrypted credentials 214. The shim plugin extension 248 can contact the VM provider 250 and prompt the VM provider 250 to generate a pod trust execution environment 260 in the external data management system 200 of the worker node 230 using the private key from the key pair 212. The shim plugin extension 248 can communicate with the newly generated pod trust execution environment 260.

[0033] The pod trust execution environment 260 may include an agent service 270 and a container runtime 280. The agent service 270 may include a data handler 272 and a container handler 274, and the container runtime 280 may include a CRI data service 282 and a CRI runtime service 284. The container handler 274 of the agent service 270 can communicate with the CRI runtime service 284 to generate a container for data storage containing the decrypted data.

[0034] The shim plugin extension 248 on worker node 230 can communicate with data handler 272 on agent service 270 in pod trust execution environment 260. Data handler 272 can decrypt encrypted credentials 214 with the private key of key pair 212. Data handler 272 can communicate with CRI data service 282, which includes transferring the decrypted data to CRI data service 282 for secure storage within pod trust execution environment 260.

[0035] Figure 3 illustrates a data management method 300 according to some embodiments of the present disclosure. The data management method 300 may include receiving a data pull request (302) and identifying whether authorization information already exists (310). If authorization information does not yet exist, the data pull request may be submitted to the CRI (334). According to some embodiments of the present disclosure, if authorization information does not yet exist, access to the CRI and the data fails (350).

[0036] If authorization information exists, the data management method 300 can proceed by detecting whether the user has provided a private key (320). If a private key has not been provided, access to the data fails (350). If the correct private key has been provided, the process can proceed by decrypting the credentials (e.g., a combination of username and password) (330) and evaluating whether the provided credentials are valid credentials. If the credentials are invalid, access to the data fails (350). If the credentials are valid, the process proceeds by generating a data pull request using the decrypted credentials (332). The process may include submitting the data pull request to the CRI (334) to grant access to the encrypted data.

[0037] Figure 4 shows a data management method 400 according to some embodiments of the present disclosure. The data management method 400 may include generating a key pair (410). The key pair may include a public key and a private key. The data management method 400 may include encrypting data to be secured using one of the keys in the key pair (for example, the public key) (412). The data management method 400 may further include storing the encrypted data (414).

[0038] Data management method 400 may include deploying a workload (420) and building an empty bundle (422). Data management method 400 may also include generating a pod trust execution environment (424).

[0039] In some embodiments of this disclosure, the data management method 400 may include generating a key pair (410) and encrypting data credentials with a public key to create a data credential secret (412). The data management method 400 may further include storing the data credential secret in a cluster on a host (414) and deploying a workload on the cluster (420). The data management method 400 may also include building an empty bundle on a host (422) and generating a pod trust execution environment (424).

[0040] In some embodiments of this disclosure, the data management method 400 may include submitting a data pull request using encrypted data pull credentials and decrypting the data credential secret with a private key in a pod trust execution environment to generate decrypted data. In some embodiments, the data management method 400 may further include transferring the data pull request to a pod trust execution environment using a shim. In some embodiments, the data management method 400 may further include submitting the decrypted data to a CRI image service in the pod trust execution environment.

[0041] In some embodiments of this disclosure, the data management method 400 may include calling a CRI runtime service to generate a real container bundle and invoking the real container bundle. In some embodiments, the data management method 400 may include decrypting a data credential secret in the real container bundle.

[0042] In some embodiments of this disclosure, the data management method 400 may include receiving a container request and receiving a pull data request using a data credential secret.

[0043] In some embodiments of this disclosure, the data credentials stored using the data management method 400 may be image credentials.

[0044] Although this disclosure includes a detailed description of cloud computing, it should be understood that the implementations of the teachings enumerated herein are not limited to cloud computing environments. Rather, embodiments of this disclosure are capable of being implemented in conjunction with any other type of computing environment currently known or to be developed in the future.

[0045] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that are rapidly provisioned and released with minimal administrative effort or interaction with service providers. This cloud model may include at least five characteristics, at least three service models, and at least four deployment models.

[0046] The characteristics are as follows:

[0047] On-demand self-service: Cloud consumers can automatically and unidirectionally provision computing power, such as server time and network storage, as needed, without requiring human interaction with service providers.

[0048] Extensive network access: Capabilities are available over the network and accessed through standard mechanisms that encourage use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0049] Resource pooling: A provider's computing resources are pooled to serve a large number of consumers using a multi-tenant model, with different physical and virtual resources dynamically allocated and reallocated according to demand. Consumers generally have no control or knowledge of the exact portion of the resources provided, but the concept of allocation independence exists, in which they may specify allocations at a higher level of abstraction (e.g., country, state, or data center).

[0050] Rapid resilience: Capabilities can be provisioned and scaled out quickly and automatically in some cases, and released quickly and scaled in quickly, in a rapid and resilient manner. To consumers, this capability, which is available for provisioning, often appears unlimited and can be purchased at any time and in any quantity.

[0051] Measured Services: Cloud systems automatically control and optimize resource usage by leveraging metric capabilities at some level of appropriate abstraction for the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both the service providers and consumers of the services being used.

[0052] The service model is as follows:

[0053] Software as a Service (SaaS): The ability offered to consumers is the use of a provider's applications running on cloud infrastructure. These applications are accessible from a variety of client devices through thin-client interfaces such as web browsers (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities, with the conceivable exception of limited, user-specific application configuration settings.

[0054] Platform as a Service (PaaS): The capability offered to consumers is the ability to deploy applications created or acquired by the consumer using programming languages ​​and tools supported by the provider onto cloud infrastructure. While consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, they have control over the deployed applications and, if applicable, the configuration of the application hosting environment.

[0055] Infrastructure as a Service (IaaS): The capability offered to consumers is the provisioning of processing, storage, networking, and other fundamental computing resources that enable consumers to deploy and run any software, including operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but they have control over the operating system, storage, and deployed applications, and, in some cases, limited control over selected networking components (e.g., the host's firewall).

[0056] The deployment model is as follows:

[0057] Private Cloud: A cloud infrastructure is operated exclusively for a specific organization. The cloud infrastructure may be managed by that organization or a third party and may reside on-premises or off-premises.

[0058] Community Cloud: Cloud infrastructure is shared by several organizations to support a specific community that shares common interests (e.g., mission, security requirements, policies, or compliance considerations, or a combination thereof). The cloud infrastructure may be managed by the organization or a third party and may reside on-premises or off-premises.

[0059] Public Cloud: Cloud infrastructure is made available to the general public or large industry groups and is owned by organizations that sell cloud services.

[0060] Hybrid Cloud: Cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain separate entities but are bound together by standardized or proprietary technologies (e.g., cloud bursting for load balancing across clouds) that enable data and application portability.

[0061] Cloud computing environments are service-oriented, focusing on statelessness, low coupling, modularity, and semantic interoperability. At the core of cloud computing is infrastructure, including a network of interconnected nodes.

[0062] Figure 5 illustrates a cloud computing environment 510 according to an embodiment of the present disclosure. As shown, the cloud computing environment 510 includes one or more cloud computing nodes 500, to which local computing devices used by cloud consumers, such as a personal digital assistant (PDA) or cellular phone 500A, a desktop computer 500B, a laptop computer 500C, or an automotive computer system 500N, or a combination thereof, can communicate with the nodes 500. The nodes 500 can communicate with each other. The nodes 500 may be physically or virtually grouped (not shown) in one or more networks, such as private, community, public, or hybrid clouds, or a combination thereof, as described above.

[0063] This allows the cloud computing environment 510 to propose infrastructure, platform, or software, or a combination thereof, as a service, without requiring cloud consumers to maintain resources on their local computing devices. The types of computing devices 500A-N shown in Figure 5 are intended for illustrative purposes only, and it should be understood that the computing node 500 and the cloud computing environment 510 can communicate with any type of computerized device over any type of network, or over a network-addressable connection, or both (for example, using a web browser).

[0064] Figure 6 illustrates an abstract model layer 600 provided by a cloud computing environment 510 (Figure 5) according to an embodiment of the present disclosure. The components, layers, and functions shown in Figure 6 are intended for illustrative purposes only, and embodiments of the present disclosure are not limited thereto. The following layers and corresponding functions are provided, as shown below:

[0065] The hardware and software layer 615 includes hardware and software components. Examples of hardware components include a mainframe 602, a RISC (Reduced Instruction Set Computer) architecture-based server 604, a server 606, a blade server 608, a storage device 611, and network and networking components 612. In some embodiments, the software components include network application server software 614 and database software 616.

[0066] The virtualization layer 620 provides an abstraction layer from which the following examples of virtual entities can be provided: a virtual server 622, virtual storage 624, a virtual network 626 including a virtual private network, a virtual application and operating system 628, and a virtual client 630.

[0067] In one example, the management layer 640 may provide the functions described below. Resource provisioning 642 provides dynamic procurement of computing resources and other resources used to perform tasks within the cloud computing environment. Metering and pricing 644 provides cost tracking when resources are used within the cloud computing environment, as well as billing or invoicing for the consumption of these resources. In one example, these resources may include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. The user portal 646 provides access to the cloud computing environment for consumers and system administrators. Service level management 648 provides resource allocation and management of cloud computing to ensure that requested service levels are met. Service level agreement (SLA) planning and execution 650 provides pre-arrangement and procurement of cloud computing resources for which future requirements are anticipated in accordance with the SLA.

[0068] Workload layer 660 provides examples of the functionality that a cloud computing environment can utilize for that purpose. Examples of workloads and functions provided from this layer include mapping and navigation 662, software development and lifecycle management 664, virtual classroom education delivery 667, data analysis processing 668, transaction processing 670, and cluster data management 672.

[0069] Figure 7 illustrates a high-level block diagram of an exemplary computer system 701 used to implement one or more of the methods, tools, and modules described herein, as well as any related functions, according to embodiments of the present disclosure (for example, using one or more processor circuits or computer processors of a computer). In some embodiments, the main components of the computer system 701 may include a processor 702, including one or more central processing units (CPUs) 702A, 702B, 702C, and 702D; a memory subsystem 704; a terminal interface 712; a storage interface 716; an I / O (input / output) device interface 714; and a network interface 718, all of which may be communicatively coupled directly or indirectly in the case of inter-component communication via a memory bus 703, an I / O bus 708, and an I / O bus interface unit 710.

[0070] The computer system 701 may house one or more general-purpose programmable CPUs 702A, 702B, 702C, and 702D, collectively referred to herein as CPU 702. In some embodiments, the computer system 701 may house a number of processors typical of relatively large systems; however, in other embodiments, the computer system 701 may instead be a single-CPU system. Each CPU 702 may execute instructions stored in the memory subsystem 704 and may include one or more levels of onboard cache.

[0071] System memory 704 may include computer system-readable media in the form of volatile memory, such as random access memory (RAM) 722 or cache memory 724. Computer system 701 may further include other removable / non-removable, volatile / non-volatile computer system storage media. For example only, a storage system 726 may be provided for reading from and writing to a non-removable, non-volatile magnetic medium, such as a “hard drive”. Although not shown, a magnetic disk drive may be provided for reading from and writing to a removable, non-volatile magnetic disk (e.g., a “floppy disk”), or an optical disk drive may be provided for reading from and writing to a removable, non-volatile optical disk, such as a CD-ROM, DVD-ROM, or other optical medium. In addition, memory 704 may include flash memory, such as a flash memory stick drive or flash drive. Memory devices may be connected to the memory bus 703 by one or more data medium interfaces. The memory 704 may include at least one program product having a set of program modules (for example, at least one) configured to perform the functions of various embodiments.

[0072] One or more programs / utilities 728 each have at least one set of program modules 730 and can be stored in memory 704. A program / utility 728 may include a hypervisor (also called a virtual machine monitor), one or more operating systems, one or more application programs, other program modules, and program data. Each of the operating systems, one or more application programs, other program modules, and program data, or any combination thereof, may include an implementation of a networking environment. A program 728, or a program module 730, or both, generally implements functions or methodologies of various embodiments.

[0073] Although Figure 7 shows the memory bus 703 as a single bus structure providing a direct communication path between the CPU 702, the memory subsystem 704, and the I / O bus interface 710, in some embodiments the memory bus 703 may include a number of different buses or communication paths, which may be arranged in any of various forms, such as point-to-point links in hierarchical, star, or web configurations, multiple hierarchical buses, parallel and redundant paths, or any other suitable type of configuration. Furthermore, although the I / O bus interface 710 and the I / O bus 708 are shown as single units, respectively, in some embodiments the computer system 701 may house a number of I / O bus interface units 710, a number of I / O buses 708, or both. Furthermore, although a number of I / O interface units 710 are shown to isolate the I / O bus 708 from various communication paths extending to various I / O devices, in other embodiments some or all of the I / O devices may be directly connected to one or more system I / O buses 708.

[0074] In some embodiments, the computer system 701 may be a multi-user mainframe computer system, a single-user system, a server computer, or a similar device that has little or no direct user interface but receives requests from other computer systems (clients). Furthermore, in some embodiments, the computer system 701 may be implemented as a desktop computer, a portable computer, a laptop or notebook computer, a tablet computer, a pocket computer, a telephone, a smartphone, a network switch or router, or any other suitable type of electronic device.

[0075] It should be noted that Figure 7 is intended to represent typical main components of an example computer system 701. However, in some embodiments, individual components may be more or less complex than those shown in Figure 7, and there may be components other than those shown in Figure 7, or additional components beyond those shown in Figure 7, and the number, type, and configuration of such components may vary.

[0076] This disclosure may be a system, method, or computer program product, or combination thereof, in an integration at any possible level of technical detail. The computer program product may include (one or more) computer-readable storage media having computer-readable program instructions for causing a processor to perform aspects of this disclosure.

[0077] A computer-readable storage medium may be a tangible device capable of holding and storing instructions for use by an instruction execution device. A computer-readable storage medium may, but is not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any preferred combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes, but is not limited to, portable computer diskettes, hard disks, random-access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random-access memory (SRAM), portable compact disk read-only memory (CD-ROM), digital versatile disks (DVDs), memory sticks (R), floppy disks (R), mechanically encoded devices such as punch cards or grooved raised structures on which instructions are recorded, and any preferred combination thereof. When used herein, computer-readable storage media should not be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses passing through optical fiber cables), or electrical signals transmitted through wires.

[0078] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or to an external computer or external storage device via a network such as the Internet, a local area network, a wide area network, or a wireless network, or a combination thereof. The network may include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, or edge servers, or a combination thereof. A network adapter card or network interface in each computing / processing device receives computer-readable program instructions from the network and transfers the computer-readable program instructions for storage on the computer-readable storage medium within each computing / processing device.

[0079] Computer-readable program instructions for performing the operations of the Disclosure may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for integrated circuits, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk(R), C++, and others, and procedural programming languages ​​such as the C programming language or similar programming languages. Computer-readable program instructions can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection to the external computer may be made (for example, through the Internet using an Internet service provider). In some embodiments, for example, an electronic circuit including a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA) can execute computer-readable program instructions by utilizing state information of computer-readable program instructions to personalize the electronic circuit in order to carry out an aspect of the present disclosure.

[0080] Aspects of the present disclosure will be described herein with reference to flowcharts or block diagrams, or both, of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It will be understood that each block in a flowchart or block diagram, or both, and combinations of blocks in a flowchart or block diagram, or both, are implemented by computer-readable program instructions.

[0081] These computer-readable program instructions may be provided to a computer or other programmable data processing device processor so that instructions executed via the processor of the computer or other programmable data processing device create means for implementing functions / operations specified in one or more blocks of a flowchart or block diagram, or both, thereby generating a machine. These computer-readable program instructions may also be stored in a computer-readable storage medium in which the instructions are stored so that the storage medium contains a product article containing instructions that implements modes of functions / operations specified in one or more blocks of a flowchart or block diagram, or both, thereby instructing a computer, a programmable data processing device, or other device, or a combination thereof, to function in a particular way.

[0082] Computer-readable program instructions may also be loaded onto a computer, other programmable device, or other device to generate a computer implementation process in which instructions executed on a computer, other programmable device, or other device implement a function / operation specified in one or more blocks of a flowchart or block diagram, or both, causing the computer, other programmable device, or other device to perform a series of operational steps.

[0083] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of the systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions described in a block may be performed in an order other than that shown in the figure. For example, depending on the functions involved, two consecutively shown blocks may actually be implemented as a single step, or they may be executed simultaneously, substantially simultaneously, in a way that partially or entirely overlaps in time, or the blocks may sometimes be executed in reverse order. It should also be noted that each block in a block diagram or flowchart, or both, and combinations of blocks in a block diagram or flowchart, or both, may be implemented by a special-purpose hardware-based system that performs a specified function or operation, or performs a combination of special-purpose hardware and computer instructions.

[0084] While this disclosure has described specific embodiments, variations and modifications thereof are expected to be obvious to those skilled in the art. The descriptions of the various embodiments of this disclosure are presented for illustrative purposes only and are not intended to be exhaustive or limitless to the disclosed embodiments. Many variations and modifications will be obvious to those skilled in the art without departing from the scope of the described embodiments. The terminology used herein has been chosen to best illustrate the principles of the embodiments, their practical applications, or the technical improvements to the technology available on the market, or to enable other those skilled in the art to understand the embodiments disclosed herein. Accordingly, the following claims are intended to be construed to encompass all such variations and modifications that fall within the scope of this disclosure.

Claims

1. A system, wherein the system Memory and A processor that communicates with the aforementioned memory and The processor is configured to perform the operation, The aforementioned operation, Generating a key pair, To create a data credential secret, the data credentials are encrypted with a public key, The aforementioned data credential secret is stored in a cluster on the host, Deploying workloads on the aforementioned cluster, To build an empty bundle on the aforementioned host, To generate a pod trust execution environment and A system that includes this.

2. The aforementioned operation, Submitting a data pull request using encrypted data pull credentials, In order to generate the decrypted data, the data credential secret is decrypted with the private key in the pod trust execution environment. The system according to claim 1, further comprising:

3. The aforementioned operation, Transfer the aforementioned data pull request to the pod trust execution environment using shim. The system according to claim 2, further comprising:

4. The aforementioned operation, To generate a real container bundle, the CRI runtime service is invoked, To launch the aforementioned real container bundle and The system according to claim 1, further comprising:

5. The aforementioned operation, Receiving container requests and Receiving a pull data request using the aforementioned data credential secret and The system according to claim 1, further comprising:

6. The system according to claim 1, wherein the data credentials are container image credentials.

7. A computer information processing method including a memory and a processor that communicates with the memory, wherein the method is Generating a key pair, To create a data credential secret, the data credentials are encrypted with a public key, The aforementioned data credential secret is stored in a cluster on the host, Deploying workloads on the aforementioned cluster, To build an empty bundle on the aforementioned host, To generate a pod trust execution environment and Methods that include...

8. Submitting a data pull request using encrypted data pull credentials, In order to generate the decrypted data, the data credential secret is decrypted with the private key in the pod trust execution environment. The method according to claim 7, further comprising:

9. Transfer the aforementioned data pull request to the pod trust execution environment using shim. The method according to claim 8, further comprising:

10. The decrypted data is submitted to the CRI image service within the pod trust execution environment. The method according to claim 8, further comprising:

11. To generate a real container bundle, the CRI runtime service is invoked, To launch the aforementioned real container bundle and The method according to claim 7, further comprising:

12. Decrypting the data credential secret in the aforementioned real container bundle The method according to claim 11, further comprising:

13. Receiving container requests and Receiving a pull data request using the aforementioned data credential secret and The method according to claim 7, further comprising:

14. The method according to claim 7, wherein the data credentials are container image credentials.

15. A computer program product, The aforementioned computer program product includes a computer-readable storage medium that embodies program instructions, The program instructions are executable by the processor to cause the processor to perform a function, The aforementioned function, Generating a key pair, To create a data credential secret, the data credentials are encrypted with a public key, The aforementioned data credential secret is stored in a cluster on the host, Deploying workloads on the aforementioned cluster, To build an empty bundle on the aforementioned host, To generate a pod trust execution environment and Computer program products, including [the following].

16. The aforementioned function, Submitting a data pull request using encrypted data pull credentials, In order to generate the decrypted data, the data credential secret is decrypted with the private key in the pod trust execution environment. The computer program product according to claim 15, further comprising:

17. The aforementioned function, Transfer the aforementioned data pull request to the pod trust execution environment using shim. The computer program product according to claim 16, further comprising:

18. The aforementioned function, To generate a real container bundle, the CRI runtime service is invoked, To launch the aforementioned real container bundle and The computer program product according to claim 15, further comprising:

19. The aforementioned function, Receiving container requests and Receiving a pull data request using the aforementioned data credential secret and The computer program product according to claim 15, further comprising:

20. The computer program product according to claim 15, wherein the data credentials are container image credentials.

Images